REP-819 Keystone V3 Filter

The mess that is Keystone v3! Comment on _everything_ so we can get this fixed up. =)
Is this set of behaviors correct? I think we are losing whatever the origin service might have populated. I feel like there's a use case where the origin service has requested that we allow a request through even if it fails our auth, because they can do some sort of auth on their side. If it then fails on their side wouldn't they populate the header with an appropriate value that we should do a addendum too saying that whatever auth scheme they have is supported plus we say keystone is supported?